Hi Tiernan, On Tue, Jun 12, 2012 at 05:18:36PM +1000, Tiernan Messmer wrote:
> If you think the exact filter may be contributing, I can send those > privately if you'd like. On an unrelated note, is it possible to filter > based on traffic direction in/out of an interface rather than relying on > matching based on network? May simplify the filters slightly if that's > what the bottleneck is. Yes, long filters can be the culprit - can you experiment ie. removing filters (and optionally defining 'none' aggregation method to plugins) ? Given your capturing framework, can you rely on MAC addresses to simplify the filtering? libpcap does not provide an indication of direction of the traffic. Cheers, Paolo _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
